4.3
CVE-2026-75601
- EPSS 0.23%
- Veröffentlicht 26.08.2026 19:53:29
- Zuletzt bearbeitet 09.09.2026 21:09:13
- Erkennungen
Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerstatic-web-server
≫
Produkt
static-web-server
Version
< 2.44.0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.137 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm
https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5